Valve Confirms: No Steam User Data Breach in Hack

Valve has firmly refuted recent reports suggesting that its Steam platform was hit by a "major" data hack, emphatically stating there was "NOT a breach" of Steam systems.

Despite concerns from some users about reports claiming over 89 million user records were compromised, Steam's thorough investigation revealed that the incident involved only a leak of "older text messages." These messages contained one-time code SMSs but crucially did not include any personal data.

In a statement published on Steam, Valve clarified that after analyzing the leak sample, it concluded that customer data remained secure. The company explained, "The leak consisted of older text messages that included one-time codes that were only valid for 15-minute time frames and the phone numbers they were sent to. The leaked data did not associate the phone numbers with a Steam account, password information, payment information, or other personal data."

Valve further reassured users, stating, "Old text messages cannot be used to breach the security of your Steam account, and whenever a code is used to change your Steam email or password using SMS, you will receive a confirmation via email and/or Steam secure messages."

Given the increasing frequency of data breaches and the vast number of Steam users—over 89 million—concerns about a potential security compromise were understandable. A notable precedent is the infamous video game-related data breach in 2011, which affected PlayStation 3 and PlayStation Portable networks, leading to a nearly month-long outage and compromising 77 million accounts.

Moreover, the risk extends beyond customer data. For instance, in October of the previous year, Pokémon developer Game Freak experienced a significant hack, resulting in leaks of data about its former and current staff, as well as its development pipeline. In 2023, Sony confirmed that data from nearly 7,000 of its current and former employees was compromised in two separate breaches. Additionally, in December 2023, hackers breached confidential data at Marvel's Spider-Man developer, Insomniac, highlighting the ongoing threat to the gaming industry.